Refactor file paths in Terraform workflows

.github/workflows/terraform-k8apps-apply.yaml

@@ -5,7 +5,7 @@ on:
     branches:
       - main
     paths:
-      - "k8sapps/**"
+      - "terraform/k8sapps/**"
 
 jobs:
   apply:
@@ -29,12 +29,12 @@ jobs:
         env:
           VAULT_MASTER_PASSWORD: ${{ secrets.VAULT_MASTER_PASSWORD }}
         run: |
-          cd k8sapps
+          cd terraform/k8sapps
           sectool exec terraform init
 
       - name: Terraform Apply
         env:
           VAULT_MASTER_PASSWORD: ${{ secrets.VAULT_MASTER_PASSWORD }}
         run: |
-          cd k8sapps
+          cd terraform/k8sapps
           sectool exec terraform apply --auto-approve

.github/workflows/terraform-k8apps-validate.yaml

@@ -1,12 +1,15 @@
 name: Validate Terraform
 
 on:
-  push:
+  pull_request:
     branches:
-      - feature/**
+      - main
     paths:
-      - "k8sapps/**"
+      - "terraform/k8sapps/**"
-
+    types:
+      - opened
+      - synchronize
+      - reopened
 jobs:
   plan:
     runs-on: ubuntu-latest
@@ -27,12 +30,12 @@ jobs:
         env:
           VAULT_MASTER_PASSWORD: ${{ secrets.VAULT_MASTER_PASSWORD }}
         run: |
-          cd k8sapps
+          cd terraform/k8sapps
           sectool exec terraform init
 
       - name: Terraform Plan
         env:
           VAULT_MASTER_PASSWORD: ${{ secrets.VAULT_MASTER_PASSWORD }}
         run: |
-          cd k8sapps
+          cd terraform/k8sapps
           sectool exec terraform plan

resources/iac_user,yaml

@@ -0,0 +1,141 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  namespace: collabora
+  name: admin-collabora
+rules:
+  - apiGroups: ["*"]
+    resources: ["*"]
+    verbs: ["*"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  namespace: gitea
+  name: admin-gitea
+rules:
+  - apiGroups: ["*"]
+    resources: ["*"]
+    verbs: ["*"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  namespace: m3uproxy
+  name: admin-m3uproxy
+rules:
+  - apiGroups: ["*"]
+    resources: ["*"]
+    verbs: ["*"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  namespace: nextcloud
+  name: admin-nextcloud
+rules:
+  - apiGroups: ["*"]
+    resources: ["*"]
+    verbs: ["*"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  namespace: wordpress
+  name: admin-wordpress
+rules:
+  - apiGroups: ["*"]
+    resources: ["*"]
+    verbs: ["*"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: namespace-creator
+rules:
+  - apiGroups: [""]
+    resources: ["namespaces"]
+    verbs: ["create", "get", "list"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: admin-collabora-binding
+  namespace: collabora
+subjects:
+  - kind: User
+    name: iac
+    apiGroup: rbac.authorization.k8s.io
+roleRef:
+  kind: Role
+  name: admin-collabora
+  apiGroup: rbac.authorization.k8s.io
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: admin-gitea-binding
+  namespace: gitea
+subjects:
+  - kind: User
+    name: iac
+    apiGroup: rbac.authorization.k8s.io
+roleRef:
+  kind: Role
+  name: admin-gitea
+  apiGroup: rbac.authorization.k8s.io
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: admin-m3uproxy-binding
+  namespace: m3uproxy
+subjects:
+  - kind: User
+    name: iac
+    apiGroup: rbac.authorization.k8s.io
+roleRef:
+  kind: Role
+  name: admin-m3uproxy
+  apiGroup: rbac.authorization.k8s.io
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: admin-nextcloud-binding
+  namespace: nextcloud
+subjects:
+  - kind: User
+    name: iac
+    apiGroup: rbac.authorization.k8s.io
+roleRef:
+  kind: Role
+  name: admin-nextcloud
+  apiGroup: rbac.authorization.k8s.io
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: admin-wordpress-binding
+  namespace: wordpress
+subjects:
+  - kind: User
+    name: iac
+    apiGroup: rbac.authorization.k8s.io
+roleRef:
+  kind: Role
+  name: admin-wordpress
+  apiGroup: rbac.authorization.k8s.io
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: namespace-creator-binding
+subjects:
+  - kind: User
+    name: iac
+    apiGroup: rbac.authorization.k8s.io
+roleRef:
+  kind: ClusterRole
+  name: namespace-creator
+  apiGroup: rbac.authorization.k8s.io